Sub-processors

HyneSite processes information about clients' workers and staff on our clients' behalf. These are the companies we use to do that: what each one does, what it handles and where the data is held.

Last updated 12 October 2026

1. Supabase

   Database, file storage and sign-in

   What it does

   Hosts the HyneSite portal's database and files, and handles signing in.

   Data it handles

   Account details, worker records, site sign-in records, right-to-work details and evidence (document photos, and the results and photos from digital checks), and the reference that links a worker to their face template.

   Where the data is held

   London, United Kingdom

   Safeguards

   Held in the UK. Covered by Supabase's data processing agreement.

2. Amazon Web Services

   Face matching (Amazon Rekognition)

   What it does

   Matches a worker's face when they enrol and each time they sign in at a gate tablet. For a digital right-to-work check with Yoti (below), it also compares the worker's face template once with the live photo Yoti took, to confirm the person Yoti checked is the person who signs in.

   Data it handles

   Face photos, which are matched in memory and not kept, and the face template made from each enrolled photo. For a digital right-to-work check, Yoti's live photo, which Amazon doesn't keep either.

   Where the data is held

   London, United Kingdom

   Safeguards

   Held in the UK. Covered by the AWS data processing addendum and its UK GDPR addendum. Amazon's AI-services opt-out is applied, so Amazon doesn't use face photos to improve its own services.

3. Resend

   Email delivery

   What it does

   Sends HyneSite's emails: invitations and join links, alerts when a worker is waiting for a right-to-work check, and the weekly right-to-work summary.

   Data it handles

   Recipients' names and email addresses, and what the email says: for example a worker's name, a site name and a link to the portal. Never face data or document photos.

   Where the data is held

   United States

   Safeguards

   Resend is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge). Its data processing agreement also includes the UK Addendum to the Standard Contractual Clauses.

4. Yoti

   Right-to-work checks (Yoti IDV)

   Not in use yet We'll start using Yoti once our agreement with Yoti, including its data processing agreement, is signed.

   What it does

   Checks a worker's right to work on the gate tablet, from their UK or Irish passport or their Home Office share code. Only for clients who switch digital checks on, and only for workers who choose it: anyone can show their documents to a site manager instead.

   Data it handles

   Photos of the worker's passport or photo ID and the details on it, and a short video and photo of their face, to check they're really there and match them to their document. For a share code, also the code, their date of birth and their Home Office record.

   Where the data is held

   United Kingdom: Yoti says it keeps this data in its UK data centres. Yoti can also let its security centre in India do manual checks, if a customer allows it. Before we start, we'll confirm with Yoti where manual checks for our clients are done, and say so here.

   Safeguards

   Yoti IDV is a certified right-to-work provider on the UK government's register of digital verification services. We delete each check at Yoti as soon as we've copied the result, and ask Yoti to delete its images within a week in any case. Yoti names the suppliers it uses itself in its terms and its privacy notice.

   Yoti's identity verification privacy notice